Generalized Encrypted Traffic Classification Using Inter-Flow Signals

2025-08-29

AI Summary

Existing encrypted traffic classification methods rely on predefined category assumptions, resulting in poor generalization. This paper proposes a prior-free, end-to-end framework that operates directly on raw PCAP data. First, it introduces a novel signal representation capturing inter-flow temporal dependencies and packet-count distributions. Second, it jointly models traffic as time series while extracting flow-level statistical features, augmented by a mutual information maximization objective to enhance discriminability of learned representations. Evaluated across multiple datasets and diverse tasks—including application identification, website fingerprinting, and malicious traffic detection—the method consistently outperforms classical approaches, achieving up to 99% accuracy. It demonstrates strong robustness against distribution shifts and exceptional cross-task generalization capability. By eliminating reliance on task-specific assumptions and enabling unified representation learning from raw network traces, this work establishes a new paradigm for general-purpose encrypted traffic analysis.

Technology Category

• Machine Learning: Privacy
• Computer Vision: Representation Learning for Vision
• Natural Language Processing: Information Extraction

Application Category

• Security and Privacy: Data transparency and provenance
• Web Mining and Content Analysis: Large pretrained models with web data
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

In this paper, we present a novel encrypted traffic classification model that operates directly on raw PCAP data without requiring prior assumptions about traffic type. Unlike existing methods, it is generalizable across multiple classification tasks and leverages inter-flow signals - an innovative representation that captures temporal correlations and packet volume distributions across flows. Experimental results show that our model outperforms well-established methods in nearly every classification task and across most datasets, achieving up to 99% accuracy in some cases, demonstrating its robustness and adaptability.

Problem

• Classifying encrypted traffic without prior assumptions
• Leveraging inter-flow signals for temporal correlations
• Generalizing across multiple tasks and datasets

Innovation

• Leverages inter-flow signals for correlations
• Operates directly on raw PCAP data
• Generalizable across multiple classification tasks